# Exoscale Documentation — IP > IP addressing for Compute instances: public IPv4 and IPv6 addresses, including how to enable IPv6 on new or existing instances. --- url: https://community.exoscale.com/product/networking/ip/ --- # IP - [Quick Start - IP](https://community.exoscale.com/product/networking/ip/quick-start/index.md) - Get started quickly with a guided setup to achieve your first successful use of the service, including the required steps and configuration. - [Overview - IP](https://community.exoscale.com/product/networking/ip/overview/index.md) - Terminology and key features at a glance, learn the core concepts, capabilities, and options of this service before you dive deeper. - [How-To - IP](https://community.exoscale.com/product/networking/ip/how-to/index.md) - Step-by-step guides to configure the service and use specific features, with clear instructions for common tasks and problem solving. - [Service Boundaries - IP](https://community.exoscale.com/product/networking/ip/service-boundaries/index.md) - Service boundaries: quotas, limits, and the guaranteed service levels (SLA) for this product, including key constraints to plan and operate reliably. - [Reference - IP](https://community.exoscale.com/product/networking/ip/reference/index.md) - Reference documentation for API, CLI, and tools, browse comprehensive details, parameters, commands, and integration notes. --- url: https://community.exoscale.com/product/networking/ip/quick-start/ --- # Quick Start - IP ## Add IPv6 to Existing Instance In the details of the instance, below the IPv4 address, you will find a toggle to enable IPv6: ![](ipv6-existing-instance.png "Enabling IPv6 for an existing instance") There is no need to reboot your instance - an IPv6 address is configured to the public interface of your instance within a few seconds. ## Add IPv6 to New Instance During instance creation, you can enable IPv6 by clicking on the toggle labeled `Enable IPv6`: ![](ipv6-new-instance.png "Enabling IPv6 during instance creation") In addition to an IPv4 address, the new instance will receive an IPv6 address. --- url: https://community.exoscale.com/product/networking/ip/overview/ --- # Overview - IP IP addresses allow machines to address each other across a network. IPv4 is still the most widely used version of the protocol, but the IPv4 address space is being consumed rapidly. IPv6 is the most recent version of the protocol, designed to solve the address space problem. ## Terminology IP Address : A unique identifier for a device on a network (e.g., 192.168.1.10 or 2001:db8::1) IPv4 : 32-bit addressing (e.g., 192.0.2.1), widely used but running out of addresses IPv6 : 128-bit addressing (e.g., 2001:db8::1), created to solve IPv4 exhaustion Subnet : A segment of an IP network defined by a subnet mask or prefix (e.g., /24 for IPv4, /64 for IPv6) Default Gateway : The router that forwards traffic to destinations outside the local network Private IP : IPs used only inside local networks (e.g., 192.168.0.0/16 or fd00::/8) Public IP : Globally routable addresses used on the Internet NAT : Network Address Translation, allows many devices to share one public IPv4 address Loopback Address : Refers to the local machine (127.0.0.1 for IPv4, ::1 for IPv6) Broadcast : (IPv4 only) Sends traffic to all devices in a subnet (e.g., 192.168.1.255) ## Features You can selectively enable IPv6 on new or existing instances. Once enabled, an IPv6 will be automatically configured on the first interface of your instance, along with its public IPv4 address. --- url: https://community.exoscale.com/product/networking/ip/how-to/ --- # How-To - IP Step-by-step guides to configure the service and use specific features, with clear instructions for common tasks and problem solving. - [Configure IPv6 Security Groups](https://community.exoscale.com/product/networking/ip/how-to/ipv6-security-group/index.md) - Configure IPv6 security groups by adding inbound and outbound rules to control traffic separately from existing IPv4 firewall settings. - [Test IPv6 Connections](https://community.exoscale.com/product/networking/ip/how-to/testing-connections/index.md) - Test IPv6 connectivity on Linux, Windows, OpenBSD, and Fedora CoreOS with ping and troubleshooting steps for address, route, and config issues. --- url: https://community.exoscale.com/product/networking/ip/how-to/ipv6-security-group/ --- # Configure IPv6 Security Groups Like for IPv4, by default, ingress traffic is filtered, and egress traffic is open. To authorize ingress traffic, you need to add IPv6-specific rules. For example, if you want to authorize SSH access from anywhere, use `::/0` as the source. `::/0` means any IPv6 host, while `0.0.0.0/0` means any IPv4 host. ![](ipv6-access.png "Ingress SSH security rule") If you already have IPv4 egress rules, outgoing IPv6 traffic is filtered, and you need to specify additional rules to allow IPv6 outbound flows. The reverse is also true: if you add IPv6 egress rules without any IPv4 egress rule, IPv4 traffic is filtered. --- url: https://community.exoscale.com/product/networking/ip/how-to/testing-connections/ --- # Test IPv6 Connections ## Linux On Linux, log into your instance and execute the following command: ```bash ping6 2001:4860:4860::8888 ``` Output: ```bash PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes 64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=51 time=4.60 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=51 time=4.08 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=3 ttl=51 time=4.13 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=4 ttl=51 time=4.12 ms ^C --- 2001:4860:4860::8888 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3004ms rtt min/avg/max/mdev = 4.085/4.237/4.607/0.214 ms ``` If you get an error, check if the IPv6 address is correctly assigned on the first interface: ```bash ip -6 a l dev eth0 ``` Output: ```bash 2: eth0: mtu 1500 state UP qlen 1000 inet6 2a04:c43:c00:12f:491:58ff:fe00:79/64 scope global mngtmpaddr dynamic valid_lft 86360sec preferred_lft 14360sec inet6 fe80::480:58ff:fe00:79/64 scope link valid_lft forever preferred_lft forever ``` In addition to the `fe80::` address prefix, you should get an address starting with `2a04::`. If you do not have the `fe80::` address prefix, IPv6 is disabled on your system. You can enable it with: ```bash sysctl -w net.ipv6.conf.all.disable_ipv6=0` ``` If you do not have the `2a04::` address prefix, the auto-configuration mechanism failed. This might be because of a locally configured firewall, or because IPv6 auto-configuration has been disabled. You can enable IPv6 auto-configuration with: ```bash sysctl net.ipv6.conf.eth0.autoconf=1 ``` If the addresses are present, check if: - you do not have a local firewall (check `ip6tables-save`), - you are not using egress rules in your security groups, and - you do not use privacy extensions (check `sysctl net.ipv6.conf.eth0.use_tempaddr`, it should be 0). ## Windows On Windows, you need to disable privacy extensions. You can disable privacy extensions by issuing the following commands in an administrative PowerShell session: ```powershell Set-NetIPv6Protocol -RandomizeIdentifiers Disabled Set-NetIPv6Protocol -UseTemporaryAddresses Disabled ``` Then, you can test with `ping6`: ```powershell ping6 2001:4860:4860::8888 ``` Output: ```powershell Pinging 2001:4860:4860::8888 with 32 bytes of data: Reply from 2001:4860:4860::8888: time<1ms Reply from 2001:4860:4860::8888: time<1ms Reply from 2001:4860:4860::8888: time=1ms Reply from 2001:4860:4860::8888: time=1ms Ping statistics for 2001:4860:4860::8888: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 1ms, Average = 0ms ``` If this does not work, use `ipconfig /all` to check if you have an IPv6 address: ```powershell ipconfig /all ``` Output: ```powershell […] Ethernet adapter Ethernet: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Red Hat VirtIO Ethernet Adapter Physical Address. . . . . . . . . : 06-6B-EA-00-00-36 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2a04:c46:c00:12f:46b:eaff:fe00:36(Preferred) Link-local IPv6 Address . . . . . : fe80::46b:eaff:fe00:36%5(Preferred) IPv4 Address. . . . . . . . . . . : 89.145.160.49(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.252.0 Lease Obtained. . . . . . . . . . : mardi, 17 avril 2018 14:10:14 Lease Expires . . . . . . . . . . : vendredi, 24 mai 2154 20:45:03 Default Gateway . . . . . . . . . : fe80::fc6b:eaff:fe00:36%5 89.145.160.1 DHCP Server . . . . . . . . . . . : 89.145.160.1 DHCPv6 IAID . . . . . . . . . . . : 55727104 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-22-67-9C-42-06-6B-EA-00-00-36 DNS Servers . . . . . . . . . . . : 89.145.160.136 89.145.161.109 185.150.8.225 NetBIOS over Tcpip. . . . . . . . : Enabled ``` Also check if you got a default route: ```powershell route print ::/0 ``` ```powershell […] IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 5 271 ::/0 fe80::fc6b:eaff:fe00:36 =========================================================================== Persistent Routes: None ``` ## OpenBSD On OpenBSD, you need to disable Semantically Opaque Interface Identifiers and privacy extensions. Add the following lines in `/etc/hostname.vio0`: ```bash -soii -autoconfprivacy ``` As of OpenBSD version 6.9 `autoconfprivacy` option has been deprecated and replaced by `temporary`. Make sure you specify `inet6 autoconf` options in `/etc/hostname.vio0` in a single line: ```bash inet6 autoconf -soii -temporary ``` Then, use `sh /etc/netstart vio0` to reload the configuration. You can test if it works correctly with `ping6`: ```bash ping6 2001:4860:4860::8888 ``` Output: ```bash PING 2001:4860:4860::8888 (2001:4860:4860::8888): 56 data bytes 64 bytes from 2001:4860:4860::8888: icmp_seq=0 hlim=61 time=1.296 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=1 hlim=61 time=1.294 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=2 hlim=61 time=1.218 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=3 hlim=61 time=1.171 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=4 hlim=61 time=1.345 ms 64 bytes from 2001:4860:4860::8888: icmp_seq=5 hlim=61 time=1.117 ms ^C --- 2001:4860:4860::8888 ping statistics --- 6 packets transmitted, 6 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 1.117/1.240/1.345/0.079 ms ``` If this does not work, check that you got an IPv6 with `ifconfig`: ```bash ifconfig vio0 ``` Output: ```bash vio0: flags=648843 mtu 1500 lladdr 06:6b:ea:00:00:36 index 1 priority 0 llprio 3 groups: egress media: Ethernet autoselect status: active inet 89.145.160.49 netmask 0xfffffc00 broadcast 89.145.163.255 inet6 fe80::46b:eaff:fe00:36%vio0 prefixlen 64 scopeid 0x1 inet6 2a04:c46:c00:12f:46b:eaff:fe00:36 prefixlen 64 autoconf pltime 14350 vltime 86350 ``` Also, check if you got the default gateway: ```bash route -n show | grep default | tail -1 ``` Output: ```bash default fe80::fc6b:eaff:fe00:36%vio0 UGS 0 3 - 56 vio0 ``` ## Fedora CoreOS On Fedora CoreOS (FCOS), Network manager default configuration is set to `stable-privacy`. `Eui64` mode is required to get IPv6 operational. It can be switched using the following command: ```bash nmcli connection modify 'Wired connection 1' ipv6.addr-gen-mode default-or-eui64 ``` A reboot is required for the change to take effect. --- url: https://community.exoscale.com/product/networking/ip/service-boundaries/ --- # Service Boundaries - IP - [Limits and Quotas - IP](https://community.exoscale.com/product/networking/ip/service-boundaries/limits-and-quotas/index.md) - IP Limitations and Quotas - [SLA - IP](https://community.exoscale.com/product/networking/ip/service-boundaries/sla/index.md) - IP Service Level Agreement - [Pricing ↗︎](https://www.exoscale.com/pricing/#eip) --- url: https://community.exoscale.com/product/networking/ip/service-boundaries/limits-and-quotas/ --- # Limits and Quotas - IP ## Limits All IPv6 addresses for your organization are taken from the same `/64` subnet (the beginning of the IPv6 address will always be the same). Currently, only one IPv6 address can be assigned for each instance. An instance that is transferred to a different organization will keep the primary IPv6 address of the source organization. ## Quotas | Usage | Quota | | ------------------------------------------------------- | -------------------------- | | quota | = Compute Instance quota | ## Availability IP is available in all zones. --- url: https://community.exoscale.com/product/networking/ip/service-boundaries/sla/ --- # SLA - IP Exoscale Networking IP product does not carry its own SLA. Refer to the Compute product SLA. --- url: https://community.exoscale.com/product/networking/ip/reference/ --- # Reference - IP - [API IP](https://community.exoscale.com/reference/api/compute/index.md) - All operations on IPs. (external) - [CLI IP](https://community.exoscale.com/reference/cli/exo/compute/index.md) - All commands on IPs. (external)